355 replies to this topic

[CodeRush]

Good day to all.

I wrote an utility to patch modern UEFI BIOSes from different vendors to prevent them from locking MSR 0xE2 and therefore make the system with patched BIOS compatible with native AppleIntelCPUPowerManagement.kext.
It's tested on Acer (Phoenix), Asrock (AMI), ASUS (AMI), Dell (Phoenix and InsydeH2O), Elitegroup (AMI), Gigabyte (AMI), Lenovo (Phoenix), MSI (AMI), Toshiba (InsydeH2O), Sony (Phoenix), Samsung (Phoenix), Zotac (AMI) boards and it works without any issues.
For Dell users with Phoenix SCT 2.0 BIOSes I added an additional patch to unlock hidden BIOS setups.

This patch works on boards based on 5th, 6th and 7th series of Intel chipsets, so neither X79 nor NM10 or similar are supported.
It's a limitation of vanilla AppleIntelCPUPowerManagement.kext and I can do nothing about that.

The utility is BSD-licensed and available on GitHub.
Compiled versions for Windows and OS X are here.
Latest version is 0.5.12

Usage: pmpatch /path/to/original.bios /path/to/patched.bios

Note on program output: if it says "Output file is generated" at the end, then one ore more modules to patch was found and patched. Do not worry about "... not found" messages, they are normal.

This program is still in development and can produce corrupt BIOS images, try them on your own risk.
I need testers with different boards from different vendors to make the utility better, so if you have enough courage or a spare BIOS chip - please try it and report in this topic.
Please attach AIDA64's or DarwinDumper's report file to your "PMPatch didn't work for me" message. Thank you in advance.

UPD: some new Gigabyte boards (GA-B75TN, for example) has locked PowerManagement module and therefore must be patched too. Current version of the utility works normally.

[TimeWalker75a]

For Dell machines with Phoenix Secure Core Tiano UEFI 2.0, such as Vostro 3750, L502x etc you can apply the patch straight to the .exe you have got from Dell.
Then flash it as if it was a stock updater thereafter. As said in the original post it will unlock all the advanced menus available for a particular machine you are patching for. The patch sequence used in this utility has originated from bios-mods, you can read this article for in-depth details on the advanced menus.

[k3nny]

Confirmed working on ASUS P8Z77-V LK v0908 CAP (capsule) file.

[CodeRush]

k3nny, FTK for Windows is easier to use and don't have any CAP verification at all, but I still don't recommend to flash BIOS under Windows - it's way too risky.
Any other system program or driver can interfere with flashing process and make unpredictable results. With strong antivirus or virtual machine enabled this chance is rather high.
It's less dangerous to use flashrom under Linux or OS X, but DOS or is still better, because nothing can interfere with flashing process in single task system (if a bunch of drivers and/or TSR's don't loaded, of course).
More to say, flashing with non-Asus tools leads to individual data loss, so now you have to restore your SMBIOS UUID, LAN MAC and Motherboard S/N using FD44Editor and then reflash BIOS to write the restored data.
Read my post on [H] linked above.

[k3nny]

Thanks for the hint. I will look into this.

[CodeRush]

New version - 0.5.9
Changes: solved a bug in free space calculation, more BIOSes can be patched.
Thanks to phpdev32, author of DPCIManager.

[buoo]

Hi CodeRush

Is the patch applied by your utility the same of this ? http://www.insanelym...vy-bridge-bios/

[CodeRush]

buoo, yes and no.
The pattern to find is also 75080fbae80f89442430, but there are 6 different patch variants that the program is trying to perform.
I have made an analysis of that assembly (warning, crappy Google-translate from Russian) and now is a bit more complex then just patching 0x75 to 0xeb.
Different patch variants are needed because after 0x75 to 0xeb patch the compressed module is often 1 byte bigger than original and there are BIOS versions that don't have even 1 byte of free space to insert it.

[CodeRush]

Confirmed working on Intel DQ77KB, modified .BIO file can be flashed with F7 update utility.

[oswaldini]

Doesn't work with Lenovo ThinkPad R61i 8932-FDG (Phoenix) and Intel SC5520SC (*.cap EFI bioses)

Intel SC5520SC: http://downloadcente...Y&DwnldID=18951

[CodeRush]

oswaldini, on 08 January 2013 - 09:23 PM, said:

Lenovo ThinkPad R61i 8932-FDG (Phoenix)

Not an UEFI, can't be patched with this program.

oswaldini, on 08 January 2013 - 09:23 PM, said:

Intel SC5520SC

Has different module organisation and doesn't have PowerManagement or CpuPei modules to patch.
Is a patch required for this board to work with native AppleICPM.kext? Is there any patched BIOS for this board anywhere?

[oswaldini]

Lenovo ThinkPad R61i and Intel SC5520SC require patching AICPUPM.kext. I haven't seen anyone who patched Intel EFI BIOSes.

EDIT: about Lenovo:

UEFI BIOS Version 8JET42WW (1.36) 
UEFI BIOS Date 2012-05-15

[CodeRush]

oswaldini, 8JET42WW can be patched by version 0.5.9 after unpacking, BIOS file to patch is $0A8J000.FL1
There is no problem to patch Intel EFI file, the main problem is to flash patched file to BIOS chip on Intel boards.
I don't know any method to flash modified Intel BIOSes with standard Intel tools, but I do know two methods to unlock access to whole BIOS and flash it with Intel Flash Programming Tool.
Another possible way to flash modified BIOS is described by phpdev32 in his mail:

Quote

I can report that the Intel DQ77KB thin mITX build I made this weekend worked just fine. Naturally I tested the newest ROM with PMPatch before I even bought the parts (just to be safe), but the F7 BIOS flasher worked just fine. I'm pretty sure the recovery flash didn't work, restarted several times without flashing, but that isn't critical. I imagine anyone wanting to repair the BIOS could flash the stock first using recovery, then flash the patched using F7 after rebooting.

[oswaldini]

Thanks for the info. About Lenovo... Facepalm ! I think about E420s, not R61i

[314TeR]

Confirmed working on P8Z68 Deluxe/GEN3. I tested version 3202, 3304 and 3603. All works ok, flashed by bupdater under dos.

[CodeRush]

I have ASUS Maximus IV Gene-Z in main system and therefore ASUS boars are well supported and tested. Thanks for report.

[bdv]

CodeRush, on 04 January 2013 - 04:11 PM, said:

The utility is BSD-licensed and available on GitHub.
Compiled versions for Windows and OS X are here.
Latest version is 0.5.9

Much better and easier than doing it under windows with Phoenix tools and an hex editor.
Thumb up.

Quote

I need testers with different boards from different vendors to make the utility better, so if you have enough courage or a spare BIOS chip - please try it and report in this topic.
Thank you in advance.

Tested on my Asus P8B-WS, bios 2106 (previously patched) with a Xeon E3-1230v2.
Works without any problem, a binary file compare show differences with my "hand-patched" bios but I can't see any differences under UEFI bios screens nor working under ML 10.8.2
Sleeps and wakes as usual, speedstep is the same using the same SSDT with modified iMac12_2.plist :

MSRDumper PStatesReached: 16 20 27 33 35 36 37.

Nice work !

[CodeRush]

bdv, on 19 January 2013 - 09:52 AM, said:

I can't see any differences under UEFI bios screens nor working under ML 10.8.2

It's normal, for AMI UEFI it only patches PowerManagement module and nothing more. Thank you for report.

[DislikeYou]

Did not work for me on Intel DZ77GA70K. I press F7 and then select .bio file and PC reboots and tries to flash but then reboots again and boots into Windows.

C:\>pmpatch GA0061.bio GA0061A.bio
PMPatch 0.5.9
PowerManagement module at 0045CC8C patched.
AMI nest modules not found.
Phoenix nest modules not found.
CpuPei module at 001FE83C not patched: Patch pattern not found.
Output file generated.

[CodeRush]

Intel is famous for difficulties on flashing modified BIOSes...
I know a way to overcome it, but it isn't simple.
Please download FTK for Windows from the link in third post, then open Administrator console, cd to FTK/Win32 and execute fpt -i command.
I need the output to guide you further.